Archived Months
June 2003
July 2003
August 2003
September 2003
October 2003
November 2003
December 2003
January 2004
February 2004
March 2004
April 2004
May 2004
June 2004
July 2004
August 2004
September 2004
October 2004
November 2004
December 2004
January 2005
February 2005
March 2005
April 2005
May 2005
June 2005
July 2005
August 2005
September 2005
October 2005
November 2005
December 2005
January 2006
February 2006
March 2006
April 2006
May 2006
June 2006
July 2006
August 2006
September 2006
October 2006
November 2006
December 2006
January 2007
February 2007
March 2007
April 2007
May 2007
June 2007
July 2007
August 2007
September 2007
October 2007
November 2007
December 2007
January 2008
February 2008
March 2008
April 2008
May 2008
June 2008


all groups > iis security > december 2004 > threads for december 1 - 7, 2004

Filter by week: 1 2 3 4 5

#exec cgi problem: lack of execute permission.
Posted by Helene Day at 12/6/2004 12:58:39 PM
I have some web pages that I try to debug. The html page invokes a shtml file, which invokes an executable, and the exe generates some html. Here is one of the shtml <html> <body> <!--#exec cgi="dice.exe?1"--> </body> </html> Here is the error when the script is execut...more >>

IIS, ASP.Net Development and Norton Internet Security 2005
Posted by TC at 12/4/2004 4:39:36 PM
Hello All, I have recently had the pleasure of installing Norton Internet Security 2005 and finding that I can no longer create or open a web-based application in Visual Studio .Net. The IDE just freezes. I tried fiddling with the configuration settings of the Norton Firewall but was not ...more >>

NormalizeUrlBeforeScan = 0 - Impact in SSL environment
Posted by Richard at 12/4/2004 11:13:05 AM
Our OWA front end servers that are in DMZ have Verisign certificates and users login using only SSL authentication. In this situation can we safely have normalizeUrlBeforeScan=0 since no other attacker could login to OWA server to view the URL of our domain/directories. Ofcourse one within ...more >>

IIS lockdown - odd log entrys
Posted by gavin NO[at]SPAM my-deja.com at 12/4/2004 9:36:22 AM
hi all, Just installed IIS on my XP pro box and decided to run the IIS lockdown tool, all seemed to go fine but I got the following in the report at the end: .. .. .. Warning: Unable to secure content (C:\WINDOWS\$NtUninstallKB828741$\comrepl.exe): Access is denied. Warning: Unable to sec...more >>

denyurlsequences
Posted by rrwillu at 12/3/2004 12:13:02 PM
Hi I have IIS 6.0 and URLscan 2.5. In IIS 6.0 there is no need to include characters we need to block under 'denyurlsequences'. this is frustrating because I can't remove/add to this list. In IIS 6.0 where does the application store denyurlsequences list so i can modify? I want to remove...more >>

SSL certificate problem
Posted by DM at 12/3/2004 10:09:02 AM
Hi I'm trying to test out how to use SSL in my web site but I'm having problems getting the test SSL certificate installed. I've installed Certificate Services on a server, downloaded and installed the root certifiacte to my laptop (where I'm developing the web site). I've created a certifi...more >>

ftp - iis5 & iis6
Posted by Param R. at 12/3/2004 10:08:39 AM
Hi all, we have run into an interesting issue. We have a domain user account that has been denied the right to log on locally. Now, we have 2 servers, 1 running iis 5 & 1 running iis 6. Both servers have a ftp site to which we need this particular domain user account to be able to login. What ...more >>

iis5 ssl security issue
Posted by Param R. at 12/3/2004 9:03:08 AM
Hi all, we have a iis5 box that has a website running over ssl and has client cert mapping enabled mapped to a local user account. Everything was working OK. We recently moved the box to a domain environment and switched the mapped user account from a local account to a domain account and now ...more >>



How to troubleshoot IIS6 anonymous authentication problem
Posted by Joe at 12/3/2004 8:11:01 AM
I'm having a problem connecting anonymously to an IIS6 Web Server. - Server is Windows 2003, IIS6 - Server is a domain controller - IUSR_SERVERNAME account has permissions to access c:\wwwroot - IUSR_SERVERNAME account is a member of IIS_WPG - IUSR_SERVERNAME account has permission to log on ...more >>

URLscan.ini - "+" in subject field
Posted by rrwillu at 12/3/2004 8:03:02 AM
Friends, We have IIS 6.0 and installed URLSCAN 2.5. In URLscan.ini [DenyUrlSequence] is empty. We couldn't open any messages that has "+" in the subject field. Not jeopardizing other characters/symbols, how i can include just "+" in url I checked the log file and it says "URL normaliz...more >>

ISS service account keeps locking out
Posted by Drew at 12/3/2004 7:51:01 AM
Hello Microsoft, You always have the answers Please take the time to read and respond to this. Please help me with this; I'm a network administrator with an account lockout problem. We have an ISS domain account which has administrative permissions to all the machines on the network. The ...more >>

IIS Anonymous User
Posted by cjj3520 NO[at]SPAM aol.com at 12/3/2004 6:39:28 AM
I have a DNS server. In the windows security log, the anonymous user (IUSR_<server name>) is recorded as logging on/off numerous times each day...at all hours of the day and night. These logons do not coincide with anything I see in the IIS log. Not knowing a whole lot about IIS, is this norma...more >>

Grabbing the username
Posted by Mitch Stone at 12/2/2004 1:23:02 PM
We're running IIS 6.0 on our company intranet, and I am building a subsite for our team using ASP. I want to capture the username of the person hitting any given webpage (so I can dynamically determine which links a user sees). I am aware that we'll need to turn off Anonymous login, and enab...more >>

Moving from IIS 5 to IIS 6
Posted by superdave at 12/2/2004 11:39:06 AM
My organization is moving from IIS 5 on a Windows 2000 server to a new Windows 2003 Server with IIS 6. My plan was to use the IIS Migration tool, however, higher ups have decdided to basically recreate the sites on the 2003 server and copy the inetpub info from the 2000 server to the 2003 ser...more >>

IIS 6 prompts for user name and password from w98 and below client
Posted by Mark Haas at 12/2/2004 8:19:03 AM
We have a IIS 6 running on Server 2003 configured for anonymous. When external clients visit the web site they are presented with a log in box. This seems to only be happening with users on Windows 98 or below. Simply clicking OK without entering any information allows them to continue. ...more >>

Solved: asp request data lost
Posted by markus.unterauer NO[at]SPAM maintec.at at 12/2/2004 4:02:18 AM
Hi, as posted before we had the strange behaviour, that when posting data within an intranet application from one asp page to another the request data (formfields, ...) was lost. Conditions, under which the problem occurs: * Server: Windows Server 2003 with IIS 6.0 * Web-Authentication: an...more >>

IIS HTTP Error 401.1
Posted by Awan at 12/2/2004 2:41:06 AM
Hei, I installed CRM on the Windows Server 2003 on three box for 100 users. A: 1 for Active Directory Domain controler (ADSRV) B: 1 for SQL 2000 + CRM Server ver 1.2 (CRMSRV) C: 1 for Exchange Server 2003 (EXSRV) i have one problem that when i type http://crmwebsite o...more >>

Integrated Windows Authentication for Gecko-based browsers
Posted by sunshine at 12/1/2004 3:23:01 PM
When integrated windows authentication is enabled in IIS, I found that the latest versions of Gecko-based browsers (Netscape 7.2, Mozilla 1.7, Firefox) now prompt for user's credentials. The interesing thing is, I don't need to specify "domain\" part of the username. It works with or without i...more >>

"ASP.NET" Permissions don't work, "Everyone" does
Posted by Chris at 12/1/2004 2:53:02 PM
Greetings, I'm running into a problem with IIS 6/ASP.NET user permissions for a site. To my knowledge, only "IUSR_SERVER" and "ASP.NET Machine Account" accounts are required on the application to run via the web. However, this is not the case for this particular application, which is creat...more >>

Security for Web server
Posted by Jason at 12/1/2004 2:33:01 PM
New to security, been reading some articles, but some help would be appreciated. I am setting up a web server, what is the best way to protect it? Setup another machine that acts as a firewall, (do not really know what this means) or just run a firewall on the same machine. If set up on a...more >>

certificate nuisance issue
Posted by robert brown at 12/1/2004 9:55:04 AM
Using company cert server (w2k) and having just renewed the annual - on several clients (XP SP2), now receive dialog that warns the cert is expired (view cert in this dialog and it is the old one). Click through to get access. Check internet options and only the new cert is availailable......more >>

Redirecting users who use http:// to https://
Posted by Marlon at 12/1/2004 8:34:51 AM
I have a site that is now SSL secured. User not still using the http:// to get to the site. How can I redirect the user the the visited page using https:// ? ...more >>

Cannot Default Domain?
Posted by Scott McCarthy at 12/1/2004 6:51:08 AM
I have a web server (Windows 2003 IIS6) that is joined into our domain. I have it setup with Windows Integrated Auth. and have also tried Digest and Basic. I cannot get the webserver to authenticate the accounts to theh domain. Everytime you try to login to a web page with a domain usernam...more >>


DevelopmentNow Blog